Bug 1313218 - Preload libmozsandbox.so in child processes on Linux. r=tedd r=billm r=glandium

Preloading libmozsandbox allows the symbol interpositions used by
sandboxing to be defined there instead of statically linked into the
executable; this patch also does that.

MozReview-Commit-ID: FL1QWLSKA0S

--HG--
rename : security/sandbox/linux/interpose/SandboxHooks.cpp => security/sandbox/linux/SandboxHooks.cpp

ipc/app/moz.build

@@ -66,7 +66,6 @@ if CONFIG['OS_ARCH'] == 'WINNT':
 if CONFIG['MOZ_SANDBOX'] and CONFIG['OS_TARGET'] in ('Linux', 'Android'):
     USE_LIBS += [
         'mozsandbox',
-        'mozsandbox_interpose',
     ]
 
     # gcc lto likes to put the top level asm in syscall.cc in a different partition

ipc/glue/GeckoChildProcessHost.cpp

@@ -841,6 +841,27 @@ GeckoChildProcessHost::PerformAsyncLaunchInternal(std::vector<std::string>& aExt
   }
 #endif // MOZ_WIDGET_GONK
 
+#if defined(XP_LINUX) && defined(MOZ_SANDBOX)
+  // Preload libmozsandbox.so so that sandbox-related interpositions
+  // can be defined there instead of in the executable.
+  // (This could be made conditional on intent to use sandboxing, but
+  // it's harmless for non-sandboxed processes.)
+  {
+    nsAutoCString preload;
+    // Prepend this, because people can and do preload libpthread.
+    // (See bug 1222500.)
+    preload.AssignLiteral("libmozsandbox.so");
+    if (const char* oldPreload = PR_GetEnv("LD_PRELOAD")) {
+      // Doesn't matter if oldPreload is ""; extra separators are ignored.
+      preload.Append(' ');
+      preload.Append(oldPreload);
+    }
+    // Explicitly construct the std::string to make it clear that this
+    // isn't retaining a pointer to the nsCString's buffer.
+    newEnvVars["LD_PRELOAD"] = std::string(preload.get());
+  }
+#endif
+
   // remap the IPC socket fd to a well-known int, as the OS does for
   // STDOUT_FILENO, for example
   int srcChannelFd, dstChannelFd;

security/sandbox/linux/Sandbox.cpp

@@ -69,7 +69,7 @@ __sanitizer_sandbox_on_notify(__sanitizer_sandbox_arguments *args);
 #endif // MOZ_ASAN
 
 // Signal number used to enable seccomp on each thread.
-MOZ_EXPORT int gSeccompTsyncBroadcastSignum = 0;
+int gSeccompTsyncBroadcastSignum = 0;
 
 namespace mozilla {
 

security/sandbox/linux/SandboxHooks.cpp

@@ -13,7 +13,7 @@
 #include <stdlib.h>
 
 // Signal number used to enable seccomp on each thread.
-extern MOZ_EXPORT int gSeccompTsyncBroadcastSignum;
+extern int gSeccompTsyncBroadcastSignum;
 
 // This file defines a hook for sigprocmask() and pthread_sigmask().
 // Bug 1176099: some threads block SIGSYS signal which breaks our seccomp-bpf

security/sandbox/linux/interpose/moz.build

@@ -1,11 +0,0 @@
-# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
-# vim: set filetype=python:
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-Library("mozsandbox_interpose")
-
-SOURCES += [
-    'SandboxHooks.cpp',
-]

security/sandbox/linux/moz.build

@@ -64,6 +64,7 @@ SOURCES += [
     'SandboxChroot.cpp',
     'SandboxFilter.cpp',
     'SandboxFilterUtil.cpp',
+    'SandboxHooks.cpp',
     'SandboxInfo.cpp',
     'SandboxLogging.cpp',
     'SandboxUtil.cpp',
@@ -108,7 +109,6 @@ if CONFIG['OS_TARGET'] != 'Android':
 DIRS += [
     'broker',
     'glue',
-    'interpose',
 ]
 
 TEST_DIRS += [